48b5eb1a14
security-audit.yml builds its hf-stack scan set by indexing [huggingfacenotorch] out of pyproject.toml with no guard. The pip release branch never had that extra, so advisory audit and the three pip scan-packages jobs died on a bare KeyError from at least 2026-07-08 to 2026-07-27 without anyone reading it as a missing extra. Add a contract test for both extras (existence, torch-free, bnb floor excludes the NaN-at-decode range) plus a check that every extra the workflow indexes actually exists, and give the workflow a message that names the problem instead of a raw traceback. |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| CODEOWNERS | ||
| dependabot.yml | ||
| FUNDING.yml | ||